Medium severity6.1NVD Advisory· Published Oct 23, 2018· Updated Jun 17, 2026

CVE-2018-12901

Description

A vulnerability in the conferencing component of Mitel ST 14.2, versions GA29 (19.49.9400.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mitel/St Firmware
cpe:2.3:o:mitel:st_firmware:*:*:*:*:*:*:*:*
Range: <19.49.9400.0
Mitel/St 14.2llm-fuzzy
Range: <=GA29 (19.49.9400.0)

Patches

Vulnerability mechanics

References

www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0007nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000